Two years after the launch of ChatGPT, AI is now used in some capacity by most major companies. But along with its rapid adoption comes a new set of risks, with some still poorly understood or not yet widely discussed.
In our latest report Their capital at risk: the rise of AI as a threat to the S&P 500, we analyzed changes in the ‘Risk Factors’ section of SEC 10-K filings from S&P 500 companies to identify how AI-related risks are being reported. These sections—typically detailed, legalistic, offer a subtle yet revealing glimpse into the concerns brewing within companies. By systematically tracking these textual changes, we aim to uncover which aspects of AI are generating the most concern across the corporate world.
This blog post provides an overview of the report’s key findings, alongside the dataset used to derive them.
Overview
By comparing the latest “Risk Factors” sections in S&P 500 companies’ 10-K filings (submitted by May 1st, 2025) with their previous filings, we found:
- 3 in 4 companies (380 total) have added or expanded upon risk concerning AI.
- Over 1 in 3 companies (193 total) have added or expanded upon risk concerning malicious actors using AI.
- The number of companies citing deepfakes as a risk has doubled, from 16 to 40.
- 1 in 5 companies (95 total) have added or expanded upon the risks concerning protection of their proprietary data or IP through interacting with AI systems.
- 1 in 10 companies (56 total) have added or expanded upon risk concerning third-party providers of AI models and software and their vulnerabilities.
- 1 in 3 utilities firms (10 total) have added references to AI’s increasing energy requirements.
- The number of companies citing EU AI Act – the European Union’s primary legislation on artificial intelligence – related risk has tripled, from 21 to 67.
- 1 in 3 companies (168 total) have added or expanded upon competitive risk relating to AI.
- The number of companies citing AI bias risk has doubled, from 70 to 146.
- 1 in 10 companies (57 total) have added or expanded upon the risk of AI failing to deliver intended benefits, success or return on investment.
- Risks to jobs rarely feature among reported risks, despite being a prominent public concern.
Dataset
Each of the above findings was derived from the following curated selection of 10-K filing extracts, where green-highlighted sections indicate newly added text, red strikethrough sections indicate removed text, and regular text remains unchanged between filings: